CVE-2023-24829

CWE-863 — Incorrect Authorization4 documents4 sources

Severity

8.8HIGH

EPSS

0.6%

top 30.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Iotdb Workbench Apache Iotdb

Timeline

PublishedJan 31

Description

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_iotdb_workbench0.13.0 — 0.13.3

▶NVDapache/iotdb0.13.0 — 0.13.3

▶PyPIapache-iotdb0.13.0 — 0.13.3

🔴Vulnerability Details

GHSA

GHSA-98mx-4vv7-3pq6: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB↗2023-01-31

▶

OSV

CVE-2023-24829: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB↗2023-01-31

▶

CVEList

Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench↗2023-01-31

▶